CVE Feed

    Dashboard / CVE / CVE-2026-94578

    CVE-2026-94578

    Brocade Fabric OS versions before 10.0.1 contain an authorization logic vulnerability in the AAA (Authentication, Authorization, and Accounting) integration framework allows remote authenticated users to gain root-equivalent chassis access controls. By returning specific, crafted Vendor-Specific Attributes (VSAs) or directory claims from an external identity provider (such as RADIUS, LDAP, TACACS+, or Federated IDP), an account can bypass administrative role restriction checks during session establishment.

    Published:Oct 8, 2026
    Last Modified:Oct 14, 2026
    EPS:Oct 8, 2026
    EPSS Score:0.00236
    CVSS Score:8.8

    Affected Products

    Vendor
    Broadcom
    Product
    Fabric Operating System
    Vendor
    Brocade
    Product
    Fabric Os

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-269 Improper Privilege Management

    Related CVEs

    CVE-2026-94585 (CVSS 7.7) — An authentication bypass vulnerability exists in the web management interface of Brocade Fabric OS versions be…
    CVE-2026-94587 (CVSS 6.9) — A buffer overflow vulnerability exists in the WebTools administrative interface handling configuration downloa…
    CVE-2026-94579 (CVSS 5.4) — An OS command injection vulnerability exists in the PAM (Pluggable Authentication Module) session cleanup rout…
    CVE-2026-94576 (CVSS 5.9) — An authentication logic and privilege escalation vulnerability exists in the account management interface of B…
    CVE-2026-87661 (CVSS 6.8) — Brocade Fabric OS versions before 9.2.2d and 10.0.0 through 10.0.0a1 directly accepts Apache configuration fil…
    CVE-2026-87677 (CVSS 5.4) — An OS command injection vulnerability exists in the account management subsystem of Brocade Fabric OS versions…
    CVE-2026-94586 (CVSS 8.5) — A command injection vulnerability exists in the WebTools administrative interface handling configuration downl…
    CVE-2026-94581 (CVSS 8.5) — An OS command injection vulnerability exists in the REST API management interface of Brocade Fabric OS version…
    CVE-2026-94577 (CVSS 7.3) — A privilege escalation vulnerability exists in the internal Command-Line Interface (CLI) authorization handlin…
    CVE-2026-87664 (CVSS 8.5) — A session context forgery vulnerability exists in the web management daemon of Brocade Fabric OS versions 9.2.…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High